Numbers Racket

The city unnecessarily asks for Social Security numbers, opening itself up to potential liability.

Two recent attention-grabbing headlines read, Arizona No. 3 in Identity Theft Rate," and "Identity Theft Top Consumer Fraud Complaint." They point to the growing trend of people's personal information being stolen, with thieves using it to run up expenses in the unsuspecting victim's name.

But another headline from a few weeks ago, "Lawsuit Accuses TriWest Healthcare of Negligence," may be of more concern to agencies that routinely collect personal information. A class-action lawsuit was filed against TriWest after laptop computers containing the personal records--including Social Security numbers--of more than 560,000 people were stolen from the Phoenix-based firm. The legal action charges the company with negligence as well as violating the federal Privacy Act.

So how does the city of Tucson protect itself from a similar situation? The city certainly collects a lot of Social Security numbers every year. Whether it is to obtain water service, apply for housing assistance or as part of a police investigation, city employees are constantly asking people for their SSN.

Those numerous requests come even after the city, based on complaints expressed by longtime consumer advocate Willy Bils, reviewed its policies a few years ago and apparently limited the number of cases where the numbers would be obtained. Despite that change, the city still frequently asks for them.

Last fall, Helen Louie contacted Tucson Water to have service turned on, one of approximately 30,000 such calls each year. She was asked for her SSN to assist the agency in identifying her, but refused to provide it.

"That's not the purpose it was designed for," Louie says. "Governments shouldn't be trusted with more information than they need."

Louie also thinks many city employees often don't comply with provisions of the federal Privacy Act which outline when, and how, a SSN is to be requested by a governmental agency. "They are very cavalier about their own observance of the law," she says.

After she objected to providing her number to Tucson Water, Louie was told it was optional, but that she would have to pay a deposit instead.

Louie's experience, along with a subsequent memorandum from Councilmember Steve Leal, did result in some revisions to Tucson Water procedures. They now notify applicants that revealing the SSN is voluntary, and the requirement of a deposit is not tied to obtaining the number.

Despite those changes, Bils insists that instead of improving on its past performance since altering its policy toward collecting Social Security numbers, the city has gotten worse about asking for them. Comparing it very unfavorably with Pima County, Bils says, "The city just does what it wants. Their approach is, 'We'll do it because we can get away with it.'"

To back up that statement, Bils cites experiences with the Tucson Police Department. When TPD officers routinely ask people for their Social Security numbers, they are legally required to inform people of several things. One is whether providing the number is voluntary or mandatory, and another is what use will be made of it. But even though there is a specific directive from the chief of police on this subject, officers frequently don't comply.

Bils has collected several personal accounts of cases like this: One person told him that when TPD officers wanted his SSN but he declined to provide it, he was verbally abused and the police threatened to impound his car. According to this affidavit, the complainant believes the TPD officers' "threats toward me were tactics they intentionally employed to intimidate me into disclosing my SSN to them against my initial express desire that I not do so."

Thousands of poor people seeking Section 8 housing assistance are also obligated by the city to provide their Social Security numbers on an application form (See "Big Brother's Neighborhood, Aug. 1, 2002). According to local program director Peggy Morales, this is done because the federal government requires the numbers of those who actually receive aid. After people have completed the form, Morales says, they will be given information about how their SSN is used to perform criminal background checks on them.

Bils vehemently protests that the city shouldn't be gathering information from thousands of applicants when only those who end up receiving housing assistance need to provide the number.

"This process has been mismanaged from the start," Bils says. "Why does the city have the right to break the law? The city decides what to do with the SSN and the housing applicants don't have any rights. They need to know [up front] what will be done with their number."

Once those SSNs are collected from people for whatever purpose, city officials insist they have a department-by-department system in place to protect them from theft. These measures include physically secure areas to store the data, the need for passwords to access files and computer firewalls to prevent hacking into the system.

Presumably, the TriWest Healthcare company also thought they had sufficient protections to prevent information from being stolen. Plus, as Louie says, "Hackers can do amazing feats that compromise supposedly secure systems."

If personal information is ever stolen from the city, the issue of whether it was collected properly will be important. Terry Anderson, director of Tucson's Risk Management division, says the type of suit filed against TriWest is a newly emerging area of the law.

He adds that if personal records, including Social Security numbers, were taken from the city and that information had been gathered inappropriately, "It would probably add more to our liability."